Overview
overview
7Static
static
7HotelMIS_special.exe
windows7-x64
7HotelMIS_special.exe
windows10-2004-x64
7$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3ConfigServer.exe
windows7-x64
1ConfigServer.exe
windows10-2004-x64
1GuiTk115.dll
windows7-x64
3GuiTk115.dll
windows10-2004-x64
3MFC71.dll
windows7-x64
1MFC71.dll
windows10-2004-x64
1help.doc
windows7-x64
4help.doc
windows10-2004-x64
1hotelMIS.exe
windows7-x64
1hotelMIS.exe
windows10-2004-x64
1libmySQL.dll
windows7-x64
3libmySQL.dll
windows10-2004-x64
3license.rtf
windows7-x64
4license.rtf
windows10-2004-x64
1msvcp71.dll
windows7-x64
3msvcp71.dll
windows10-2004-x64
3msvcr71.dll
windows7-x64
3msvcr71.dll
windows10-2004-x64
3mysqld.exe
windows7-x64
1mysqld.exe
windows10-2004-x64
1share/char...s.html
ubuntu-18.04-amd64
1share/char...s.html
debian-9-armhf
1share/char...s.html
debian-9-mips
1share/char...s.html
debian-9-mipsel
1tmpl/ReportDay.xls
windows7-x64
1tmpl/ReportDay.xls
windows10-2004-x64
1tmpl/ReportSsy.xls
windows7-x64
1tmpl/ReportSsy.xls
windows10-2004-x64
1Analysis
-
max time kernel
140s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
23-07-2024 10:21
Behavioral task
behavioral1
Sample
HotelMIS_special.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
HotelMIS_special.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
ConfigServer.exe
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
ConfigServer.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral7
Sample
GuiTk115.dll
Resource
win7-20240704-en
Behavioral task
behavioral8
Sample
GuiTk115.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral9
Sample
MFC71.dll
Resource
win7-20240708-en
Behavioral task
behavioral10
Sample
MFC71.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral11
Sample
help.doc
Resource
win7-20240705-en
Behavioral task
behavioral12
Sample
help.doc
Resource
win10v2004-20240709-en
Behavioral task
behavioral13
Sample
hotelMIS.exe
Resource
win7-20240705-en
Behavioral task
behavioral14
Sample
hotelMIS.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral15
Sample
libmySQL.dll
Resource
win7-20240704-en
Behavioral task
behavioral16
Sample
libmySQL.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral17
Sample
license.rtf
Resource
win7-20240708-en
Behavioral task
behavioral18
Sample
license.rtf
Resource
win10v2004-20240709-en
Behavioral task
behavioral19
Sample
msvcp71.dll
Resource
win7-20240704-en
Behavioral task
behavioral20
Sample
msvcp71.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral21
Sample
msvcr71.dll
Resource
win7-20240704-en
Behavioral task
behavioral22
Sample
msvcr71.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral23
Sample
mysqld.exe
Resource
win7-20240708-en
Behavioral task
behavioral24
Sample
mysqld.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral25
Sample
share/charsets/languages.html
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral26
Sample
share/charsets/languages.html
Resource
debian9-armhf-20240611-en
Behavioral task
behavioral27
Sample
share/charsets/languages.html
Resource
debian9-mipsbe-20240418-en
Behavioral task
behavioral28
Sample
share/charsets/languages.html
Resource
debian9-mipsel-20240418-en
Behavioral task
behavioral29
Sample
tmpl/ReportDay.xls
Resource
win7-20240708-en
Behavioral task
behavioral30
Sample
tmpl/ReportDay.xls
Resource
win10v2004-20240709-en
Behavioral task
behavioral31
Sample
tmpl/ReportSsy.xls
Resource
win7-20240708-en
Behavioral task
behavioral32
Sample
tmpl/ReportSsy.xls
Resource
win10v2004-20240709-en
General
-
Target
hotelMIS.exe
-
Size
581KB
-
MD5
2bd54cefa92e14d3749dfdecfba3a7c5
-
SHA1
646250e7789d63530d87bcf4854002e9be3919b0
-
SHA256
8663fb47b09c6cf2712ffb219be9a1f810ede0f9331d4157061ba2a9c5a9d86a
-
SHA512
ecc132e539fc5c7d6858255b123d95261f316f7640372fd0ebfce83d44dfdc9850f490dc7bb8ab115d5d8c14b88432256262dfbae2894fb409fc38bf3c494872
-
SSDEEP
12288:fVqkJBjMoi22lBqi9EuUuIiWDSxiQ1kPZbwbn:fPhMoL0ndHWEiQ1kPGb
Malware Config
Signatures
-
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 976 hotelMIS.exe 976 hotelMIS.exe 976 hotelMIS.exe